EP2541457A2 - Method and system of location-aware certificate based authentication - Google Patents

Method and system of location-aware certificate based authentication Download PDF

Info

Publication number
EP2541457A2
EP2541457A2 EP12172793A EP12172793A EP2541457A2 EP 2541457 A2 EP2541457 A2 EP 2541457A2 EP 12172793 A EP12172793 A EP 12172793A EP 12172793 A EP12172793 A EP 12172793A EP 2541457 A2 EP2541457 A2 EP 2541457A2
Authority
EP
European Patent Office
Prior art keywords
public key
location
server
public
request
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP12172793A
Other languages
German (de)
French (fr)
Other versions
EP2541457A3 (en
EP2541457B1 (en
Inventor
Sitaraman Suthamali Lakshminarayanan
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
General Electric Co
Original Assignee
General Electric Co
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US13/169,471 priority Critical patent/US10068084B2/en
Application filed by General Electric Co filed Critical General Electric Co
Publication of EP2541457A2 publication Critical patent/EP2541457A2/en
Publication of EP2541457A3 publication Critical patent/EP2541457A3/en
Application granted granted Critical
Publication of EP2541457B1 publication Critical patent/EP2541457B1/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44Program or device authentication
    • G06F21/445Program or device authentication by mutual authentication, e.g. between devices or programs
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • H04L63/0823Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network using certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to network resources
    • H04L63/107Network architectures or network communication protocols for network security for controlling access to network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2111Location-sensitive, e.g. geographical location, GPS
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115Third party
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04QSELECTING
    • H04Q2209/00Arrangements in telecontrol or telemetry systems
    • H04Q2209/40Arrangements in telecontrol or telemetry systems using a wireless architecture
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04QSELECTING
    • H04Q2209/00Arrangements in telecontrol or telemetry systems
    • H04Q2209/60Arrangements in telecontrol or telemetry systems for transmitting utility meters data, i.e. transmission of data from the reader of the utility meter
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04SSYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

In one aspect, a method of mutual certificate authentication between a first device (104) and a second device (106) based on location is described. This embodiment of a method comprises receiving a request from a first device (104), wherein the request comprises a location of the first device (104); registering a first public key for the first device (104) in response to the request, wherein the registration associates the first device (104) with the first public key; determining at least one second device (106) that can be accessed by the first device (104) based upon a location of the second device (106) relative to the location of the first device (104); registering a second public key for the second device (106), wherein the registration associates the second device (106) with the second public key; sending the second public key to the first device (104); sending the first public key to the second device (106); and mutually authenticating the first device (104) to the second device (106) when the first device (104) and the second device (106) are connected.

Description

    BACKGROUND OF THE INVENTION
  • The subject matter disclosed herein relates to security and, in particular, to mutual certificate authentication between a first device and a second device based on location of the first device relative to the second device.
  • In many instances, varieties of devices for the utility industry are deployed on pole tops, in manholes, in substations and other locations that are used to collect data, send data, perform grid operations, etc. Most of these devices either have their locations stored in database repositories or are now equipped with location devices such as GPS receivers and the like. While such devices are generally operated from a central place, in many instances it is desired that the devices can be operated with a handheld device proximate to the device. However, it is desired that this access be secure in order to protect the data as well as the system that the utility device operates on.
  • Securing messages between distributed software applications such as software applications residing on a utility device and on a handheld device typically requires the usage of Public-Private key pair exchanges between the applications. The keys are typically disturbed in a public key infrastructure (PKI) where public keys are bound to their respective user identities by means of a certificate authority (CA). However, in many instances, once authenticated, the applications are able to access one another in accordance with their authentications for an unlimited duration and from any location.
  • Therefore, systems and methods of performing mutual certificate authentication between a first device and a second device based on the locations of the first and second device relative to one another are desired.
  • BRIEF DESCRIPTION OF THE INVENTION
  • Described herein are embodiments of systems and methods for performing mutual certificate authentication between a first device (e.g., a mobile device or a handheld unit) and a second device (e.g., a utility device), where certificates are issued on demand to the first device and the second device, based on the current location of the first device relative to the second device.
  • In one aspect, a method of mutual certificate authentication between a first device and a second device based on location is described. This embodiment of a method comprises receiving a request from a first device, wherein the request comprises a location of the first device; registering a first public key for the first device in response to the request, wherein the registration associates the first device with the first public key; determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device; registering a second public key for the second device, wherein the registration associates the second device with the second public key; sending the second public key to the first device; sending the first public key to the second device; and mutually authenticating the first device to the second device when the first device and the second device are connected.
  • In another aspect, a method of mutual certificate authentication between a first device and a second device based on location is described. This embodiment of a method comprises sending a request from a first device to a server, wherein the request comprises location information for the first device; generating, by a first software agent residing on the first device, a first public key and a first private key; registering, by the server, the first public key for the first device, wherein the registration associates the first device with the first public key; issuing, by the server, a first certificate to the first device; determining, by the server, at least one second device that is accessible by the first device based on the location of the second device relative to the first device; notifying, by the server, the second device that the first device requests access to the second device; generating, by a second software agent residing on the second device, a second public key and a second private key in response to the notification; registering, by the server, the second public key for the second device, wherein the registration associates the second device with the second public key; issuing, by the server, a second certificate to the second device; sending, by the server, the second public key to the first device; sending, by the server, the first public key to the second device; and mutually authenticating, by the server, the first certificate and the second certificate when the first device and the second device are connected.
  • In yet another aspect, a system for mutual certificate authentication between a first device and a second device based on location is described. This embodiment of a system comprises a first device, wherein the first device is comprised of at least a first software agent executing on a first processor and a first communications interface, and the first device is configured to determine its location; a second device, wherein the second device is comprised of at least a second software agent executing on a second processor and a second communications interface; a server comprised of at least a memory, a server communications interface and a server processor, wherein the server is configured to communicate with the first device and the second device and wherein the server processor is configured to: receive a request from a first device, wherein the request comprises a location of the first device; register a first public key for the first device in response to the request, wherein the registration associates the first device with the first public key; determine at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device; register a second public key for the second device, wherein the registration associates the second device with the second public key; send the second public key to the first device; send the first public key to the second device; and mutually authenticate the first device to the second device when the first device and the second device are connected.
  • Additional advantages will be set forth in part in the description which follows or may be learned by practice. The advantages will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive, as claimed.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments and together with the description, serve to explain the principles of the methods and systems:
    • FIG. 1 is an overview illustration of one type of system that would benefit from embodiments of the present invention;
    • FIG. 2 is another overview illustration of one type of system that would benefit from embodiments of the present invention;
    • FIG. 3 is an overview illustration of one embodiment of a system for mutual certificate authentication between a first device and a second device based on location;
    • FIG. 4 is an overview illustration of an alternate embodiment of a system for mutual certificate authentication between a first device and a second device based on location;
    • FIG. 5 illustrates a schematic block diagram of an entity capable of operating as one of a first device or second device shown in accordance with one embodiment of the present invention;
    • FIGS. 6A and 6B illustrate alternative embodiments of the entity shown in FIG. 5, and illustrate embodiments of a schematic block diagram of entities capable of operating as one of a first device or second device;
    • FIG. 7 is a flowchart illustrating a method of practicing an embodiment of the present invention; and
    • FIG. 8 is a block diagram illustrating an exemplary operating environment for performing the disclosed methods.
    DETAILED DESCRIPTION OF THE INVENTION
  • Before the present methods and systems are disclosed and described, it is to be understood that the methods and systems are not limited to specific synthetic methods, specific components, or to particular compositions. It is also to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting.
  • As used in the specification and the appended claims, the singular forms "a," "an" and "the" include plural referents unless the context clearly dictates otherwise. Ranges may be expressed herein as from "about" one particular value, and/or to "about" another particular value. When such a range is expressed, another embodiment includes from the one particular value and/or to the other particular value. Similarly, when values are expressed as approximations, by use of the antecedent "about," it will be understood that the particular value forms another embodiment. It will be further understood that the endpoints of each of the ranges are significant both in relation to the other endpoint, and independently of the other endpoint. Further, when examples of ranges are provided herein, it is to be appreciated that the given ranges also include all subranges therebetween, unless specifically stated otherwise.
  • "Optional" or "optionally" means that the subsequently described event or circumstance may or may not occur, and that the description includes instances where said event or circumstance occurs and instances where it does not.
  • Throughout the description and claims of this specification, the word "comprise" and variations of the word, such as "comprising" and "comprises," means "including but not limited to," and is not intended to exclude, for example, other additives, components, integers or steps. "Exemplary" means "an example of" and is not intended to convey an indication of a preferred or ideal embodiment. "Such as" is not used in a restrictive sense, but for explanatory purposes.
  • Disclosed are components that can be used to perform the disclosed methods and systems. These and other components are disclosed herein, and it is understood that when combinations, subsets, interactions, groups, etc. of these components are disclosed that while specific reference of each various individual and collective combinations and permutation of these may not be explicitly disclosed, each is specifically contemplated and described herein, for all methods and systems. This applies to all aspects of this application including, but not limited to, steps in disclosed methods. Thus, if there are a variety of additional steps that can be performed it is understood that each of these additional steps can be performed with any specific embodiment or combination of embodiments of the disclosed methods.
  • The present methods and systems may be understood more readily by reference to the following detailed description of preferred embodiments and the Examples included therein and to the Figures and their previous and following description.
  • In many instances, varieties of devices for the utility industry are deployed on pole tops, in manholes, in substations, and other locations that collect data, send data, perform grid operations, etc. In many instances, the location (e.g., coordinates) of these devices are stored in a database or other computer-accessible central repository or the utility devices are equipped with location devices such as GPS receivers and the like. While most of these utility devices can be operated from a central place, can also be operated with a mobile device (e.g., a handheld device) proximate to the device. Generally, the mobile device accesses or connects to the utility device wirelessly, though wired (including fiber optic) connections are also contemplated within the scope of embodiments of this invention.
  • Embodiments of the described invention can perform mutual certificate authentication between a first device (e.g. a mobile device or handheld unit) and a second device (e.g., a utility device). Authentication certificates are issued on demand to the first device and the second device, based on the current location of the first device relative to the second device. In one aspect, the certificates may be valid for only a short period of time. When the first device intends to initiate a connection with another utility device in the field, a new certificate is issued to the first device and based on its location, and based on a list of devices the first device is authorized to perform operations on, new certificates are issued to the utility devices within a defined distance of the first device. Once certificates are issued and exchanged, the first device (e.g., mobile device) can authenticate itself to the proximate utility device. Embodiments of this invention help prevent a rogue user from using a different mobile device to gain access utility devices in a different location and helps prevent cascading failure when a mobile device is lost or stolen. Embodiments also prevent a mobile device from accessing utility devices in a different geographic region. Therefore, a beneficial effect of the described embodiments is to allow access and secure communications between a first device and a second device while the first device and the second device are at or within a pre-defined distance or radius of one another. In one aspect, such access may be limited to a defined duration regardless of the proximity of the first device and the second device.
  • FIG. 1 illustrates an exemplary distributed system 100 according to one embodiment. The distributed system 100 includes a management server 102. As described in greater detail below, the management server 102 manages the distribution of key pairs among software applications in the system 100. As such, the management server 102 is a PKI management console in one embodiment. In one embodiment, keys are provided to software applications residing on, for example, first device 104 and one or more second devices 106. Though shown as a server 102, the management console can be implemented in a server or other computing device.
  • The system 100 illustrated in FIG. 1 also includes a communication network 108. The physical media of the network can be wired (including fiber optic), or wireless, or a combination of wired and wireless. The communication network 108 can be any type of communication network now known or later developed. For example, the communication network 108 can be the Internet, a private network, a local area network (LAN) or a wide area network (WAN). It shall be understood that the communication network 108 can include more than one network. For example, the communication network 108 can include a LAN in communication with a WAN in one embodiment. In another embodiment, the communication network 108 can include an internal bus within a single server and any combination of other networks. Such an embodiment may exist in the event that one or more software applications are resident on the same server. In one aspect, the network 108 enables the devices 102, 104, 106 of the exemplary system 100 to connect with one another.
  • In one aspect, an embodiment of the system 100 can also include one or more resident software applications 110, 112 configured to execute on one or more processors associated with the first device 104 and the second device 106. The software applications 110, 112 are communicatively coupled to the communication network 108 such that they can communicate with one another and the management server 102. In operation, the software application 110 of the first device 104 and the software application 112 of the second device 106 enable the first device 104 and the second device 106 to connect with one another through the network 108. The number of software applications 110, 112 in an embodiment of the system 100 is variable, not limited, and depends on the context. The software applications 110, 112 can all be located on different devices 104, 106 in one embodiment. In another embodiment, at least one software application 110, 112 is located on the same device as another software application.
  • In one embodiment, one or more of the software applications 110, 112 may need to communicate encrypted information to and receive encrypted information from another one of the software applications 110, 112. In such an embodiment, the software applications 110, 112 need to exchange public keys with one another. It shall be understood the software applications 110, 112 may need to send digitally signed messages to one another. In such a case, and by way of example, software application 110 can register its public key with the management server 102 and then software application 112 can subscribe to that public key. Similarly, and by way of example, software application 112 can register its public key with the management server 102 and then software application 110 can subscribe to that public key. In operation, software application 110 can sign a message sent to software application 112 with its private key and software application 112 can sign a message sent to software application 110 with its private key. Software applications 110, 112 can then verify the signatures using the public keys they received from the management console 102. In one aspect, registering a first public key for the first device 104 comprises the server 102 generating a public/private key pair for the first device 104 and distributing the key pair to the first device 104. In another aspect, registering a first public key for the first device 104 comprises the server 102 receiving the first public key from the first device 104, wherein a software agent 110 residing on the first device 104 generates a public/private key pair for the first device 104. In one aspect, registering a second public key for the second device 106 comprises the server 102 generating a public/private key pair for the second device 106 and distributing the key pair to the second device 106. In another aspect, registering a second public key for the second device 106 comprises the server 102 receiving the second public key from the second device 106, wherein a software agent 112 residing on the second device 106 generates a public/private key pair for the second device 106. In one aspect, the first public key or the second public key are valid only while the first device 104 is located at or within a defined distance of the second device 106. In another aspect, the first public key or the second public key are valid only for a defined period of time.
  • According to one embodiment, the management server 102 is configured to manage the exchange of keys between software applications 110, 112. As such, in one embodiment the management server 102 is coupled to a central key store that stores public keys for some or all of the software applications 110, 112 and any information associated with the stored public keys. The associated information can include, for example, identification of other software applications residing on devices that are allowed to receive the public key, when the key expires, location (e.g. coordinates) of the device that owns the public key, a defined radius or distance around the device that owns the public key wherein the device can access the public key(s) of other devices at or within that defined distance or radius, and the like. In general, the central key store is a database and can be included within or be a separate entity from the management server 102. For example, the central key store connection with the management server could be through the communications network 108 or directly to (or within) the management server 102 in alternative embodiments. In one embodiment, the central key store is implemented as a database utilizing a lightweight directory access protocol (LDAP).
  • In one embodiment, the management server 102 can be coupled to a user terminal (not shown) that allows a user (e.g., a system administrator) to provide information to the management server 102. In one embodiment, the system administrator provides the management server 102 with information about particular software applications that can register/store their public key on the management console server or that can use the management console 102 to generate a key pair and store the resulting public key. The generation of key pairs can be implemented in a known manner. In alternative embodiments, the information about particular software applications that can utilize the management server 102 can be received from other sources.
  • Each software application 110, 112 is also coupled to an application key store. The application key stores can be maintained by any known or later developed keytool, respectively. A keytool is a key and certificate management utility. It enables the software applications 110, 112 to administer their own public/private key pairs and associated certificates for use in self-authentication (where the software application authenticates itself to other software application) or data integrity and authentication services, using digital signatures. It also allows software applications 110, 112 to cache the public keys (optionally, in the form of certificates) of their other software applications. The keytools can be implemented by known methods. As discussed above, the management server 102 can control distribution of the public keys.
  • Now referring to FIG. 2, an example of the operation of the system 100 can be informative. Suppose that the first device 104 desires to access a second device 106, wherein the second device is within a pre-defmed distance (radius = r) 116 of the first device 104. For example, the first device 104 can be a mobile device such as a handheld meter-reading device and the second device 106 can be a utility device such as, for example, a utility meter (e.g., a smart meter). And, as non-limiting examples, the pre-define distance or radius (r) can be 50 feet, feet meters, 50 yards, 100 feet, 100 meters, 100 yards, 1000 ft, 1000 meters, 1000 yards, etc., and any distance in-between. Other examples of a utility device can include, for example, a phasor measurement unit, a phasor data concentrator, power quality products, and the like. Other examples of the mobile device can include, for example, field/hand-held devices, laptop computers with GPS capability, mobile phones with GPS capability, tablet devices such as an iPad (Apple Inc., Cupertino, CA), Cisco Cius (Cisco Systems, Inc., San Jose, CA), and the like. The first device 104 may send an encrypted message to the second device 106 in order to retrieve data (such as electric consumption information) from the second device 106, and the second device may transmit the data to the first device 104 in an encrypted manner. Therefore, there is a need for a method for mutual certificate authentication between the first device 104 and the second device 106 based on location. One embodiment of the method comprises a server 102 receiving a request from a first device 104, wherein the request also includes a location of the first device. For example, the first device 104 can be equipped with a location determination device such as a GPS receiver, or the like and the location of the first device 104 can be transmitted to the server 102 along with the request. In one aspect, the request is a request to access a second device 106, wherein the second device 106 is within a certain distance or radius 116 of the location of the first device 104. The request can be made to the server 102 over a network 108. In one aspect, at least part of the network 108 can comprise an advanced metering infrastructure (AMI) network. AMI refers to systems that measure, collect and analyze energy usage, and interact with advanced devices such as electricity meters, gas meters, water meters, and the like through various communication media either on request (on-demand) or on pre-defined schedules. This infrastructure includes hardware, software, communications, consumer energy displays and controllers, customer associated systems, meter data management (MDM) software, supplier and network distribution business systems, and the like. The network 108 between the devices 104, 106 and server 102 allows collection and distribution of information to customers, suppliers, utility companies and service providers. This enables these businesses to either participate in, or provide, demand response solutions, products and services. By providing information to customers, the system assists a change in energy usage from their normal consumption patterns, either in response to changes in price or as incentives designed to encourage lower energy usage use at times of peak-demand periods or higher wholesale prices or during periods of low operational systems reliability. In one aspect, the network 108 can comprise at least a portion of a smart grid network. In one aspect, the network 108 can utilize one or more of one or more of a WPAN (e.g., ZigBee, Bluetooth), LAN/WLAN (e.g., 802.11n, microwave, laser, infrared, etc.), WMAN (e.g., WiMAX, etc.), WAN/WWAN (e.g., UMTS, GPRS, EDGE, CDMA, GSM, CDPD, Mobitex, HSDPA, HSUPA, 3G, etc.), RS232, USB, Firewire, Ethernet, wireless USB, cellular, OpenHAN, power line carrier (PLC), broadband over power lines (BPL), and the like. In response to the request received by the server 102 from the first device 104, the first device 104 registers a first public key for the first device 104 with the server 102, wherein the registration associates the first device 104 with the first public key. In one aspect, registering a first public key for the first device 104 in response to the request comprises the server 102 generating a public/private key pair for the first device 104 and distributing the key pair to the first device 104. In another aspect, registering a first public key for the first device 104 in response to the request comprises the server 102 receiving the first public key from the first device, wherein a software agent 110 residing on the first device 104 generates a public/private key pair for the first device 104.
  • The server 102 is configured to determine at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104. In one aspect, the locations of one or more devices such as second device 106 and third device 114 are stored in a memory associated with the server 102 so that the server 102 can use the location provided by the first device 104 to determine the at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104. In another aspect, the server 102 is in communication with devices such as second device 106 and third device 114 via a network 108 and these devices 106, 114 further comprise a location determination device such as a GPS receiver or the like and the devices 106, 114 transmit their locations to the server 102 and the server 102 can use the locations provided by the devices 106, 114 to determine the at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104. The server 102 registers a second public key for the second device 106, wherein the registration associates the second device 106 with the second public key. In one aspect, registering a second public key for the second device 106 comprises the server 102 generating a public/private key pair for the second device 106 and distributing the key pair to the second device 106. In another aspect, registering a second public key for the second device 106 comprises the server 102 receiving the second public key from the second device 106, wherein a software agent 112 residing on the second device 106 generates a public/private key pair for the second device 106.
  • The server 102 sends the second public key to the first device 104 and sends the first public key to the second device 106 over the network 108. As each, the first device 104 and the second device 106 now have the second public key and the first public key, respectively, the first device 104 and the second device mutually authenticate when the first device 104 and the second device 106 are connected. In one aspect, the first public key or the second public key are valid only while the first device 104 is located at or within a defined distance 116 of the second device 106. Therefore, in one aspect, the first device 104 either continuously or intermittently sends its location information to the server 102 so that when the first device 104 is moved to a location outside the pre-define distance or radius (r), then the first public key or the second public key are no longer valid in accordance with PKI protocol and as such, the first device 104 is unable to maintain a connection or communications with the second device 106. In another aspect, the first public key or the second public key are valid only for a defined time period.
  • FIG. 3 is an overview illustration of one embodiment of a system 300 for mutual certificate authentication between a first device 104 and a second device 106 based on location. In one aspect, the first device is a mobile device and the second device is a utility device. In one aspect, the utility device is a utility meter. In other aspects, examples of a utility device can include, for example, a phasor measurement unit, a phasor data concentrator, power quality products, and the like. Other examples of the mobile device can include, for example, field/hand-held devices, laptop computers with GPS capability, mobile phones with GPS capability, tablet devices such as an iPad (Apple Inc., Cupertino, CA), Cisco Cius (Cisco Systems, Inc., San Jose, CA), and the like. The illustrated embodiment of a system is comprised of a first device 104. In one aspect, the first device 104 is comprised of at least a first software agent 302 executing on a first processor and a first communications interface 304. In one aspect, the first device 104 is configured to determine its location using a location determination device 306 such as, for example, a GPS receiver, triangulation of a cellular or mobile telephone receiver, or the like. Further comprising the embodiment shown in FIG. 3 is a second device 106. In one aspect, the second device 106 is comprised of at least a second software agent 308 executing on a second processor and a second communications interface 310. The embodiment of a system 300 of FIG. 3 also includes a server 102. In one aspect, the server 102 is comprised of at least a memory 312, a server communications interface 314 and a server processor 316. In one aspect, the server 102 is configured to communicate with the first device 104 and the second device 106 over a network 108. In one aspect, the server processor 316 is configured to receive a request from the first device 104. Included with the request from the first device 104 is a location of the first device 104. The server processor 316 is further configured to register a first public key for the first device 104 in response to the request. The registration associates the first device 104 with the first public key. In one aspect, registering a first public key for the first device 104 in response to the request comprises the server processor 316 generating a public/private key pair for the first device 104 and distributing the key pair to the first device 104. In one aspect, registering a first public key for the first device 104 in response to the request comprises the server 102 receiving the first public key from the first device 104, wherein the first software agent 302 residing on the first device 104 generates a public/private key pair for the first device 104.
  • The server processor 316 is configured to determine at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104 and to register a second public key for the second device 106. The registration associates the second device 106 with the second public key. In one aspect, determining at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104 comprises the server processor 316 retrieving stored locations of one or more second devices 106 from a database stored in the memory 312 and comparing the location of the first device 104 to the locations of the one or more second devices 106 to determine whether the second device 106 is at or within a defined distance from the first device 104. In another aspect, the second device 106 is configured to determine its location and determining at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104 comprises the server processor 316 receiving location information from the second device 106 and comparing the location of the first device 104 to the location of the second device 106 to determine whether the second device 106 is at or within a defined distance from the first device 104. In one aspect, registering a second public key for the second device 106 comprises the server processor 316 generating a public/private key pair for the second device 106 and distributing the key pair to the second device 106. in another aspect, registering a second public key for the second device 106 comprises the server 102 receiving the second public key from the second device 106, wherein a second software agent 308 residing on the second device 106 generates a public/private key pair for the second device 106. The server processor 316 is further configured to send the second public key to the first device 104; send the first public key to the second device 106; and mutually authenticate the first device 104 to the second device 106 when the first device and the second device are connected. In one aspect, the first public key or the second public key are valid only while the first device 104 is located at or within a defined distance of the second device 106. In another aspect, the first public key or the second public key are valid only for a defined time period.
  • FIG. 4 is an overview illustration of an alternate embodiment of a system 400 for mutual certificate authentication between a first device 104 and a second device 106 based on location. In this alternate embodiment, the second device 106 is configured to determine its location using a location determination device 402 such as, for example, a GPS receiver, triangulation of a cellular or mobile telephone receiver, or the like. Therefore, when the server processor 316 is determining at least one second device 106 that can be accessed by the first device 104 based upon a location of the second device 106 relative to the location of the first device 104 comprises receiving location information from the second device 106 as determined by the location determination device 402 of the second device 106 and comparing the location of the first device 104 to the location of the second device 106 to determine whether the second device 106 is at or within a defined distance from the first device 104.
  • Referring now to FIG. 5, a schematic block diagram of entities capable of operating as one of a first device 104 or second device 106 are shown in accordance with one embodiment of the present invention. The entities capable of operating as one of a first device 104 or second device 106 include various means for performing one or more functions in accordance with embodiments of the present invention, including those more particularly shown and described herein. It should be understood, however, that one or more of the entities may include alternative means for performing one or more like functions, without departing from the scope of the present invention. As shown, the entity capable of operating as one of a first device 104 or second device 106 can generally include means, such as one or more processors 504 for performing or controlling the various functions of the entity. In one aspect, the one or more processors can be, for example, one or more of a NEC v850 family microprocessor (NEC Corporation, Tokyo, Japan) and/or a Teridian 6533 controller or a Teridian 6521 controller as are available from Maxim Integrated Products, Inc. (Sunnyvale, California), among others. As shown in FIG. 5, in one embodiment, the one of a first device 104 or second device 106 can comprise a location determination device 502 that can be used to determine the present location of the one of a first device 104 or second device 106. In various aspects, the location determination device 502 can comprise one or more of a GPS (global positioning system) receiver, a cellular or other mobile communications receiver that can be triangulated for location determination, and the like as are known to one of ordinary skill in the art. Further comprising this embodiment of one of a first device 104 or second device 106 are one or more processors 504 and memory 506.
  • In one embodiment, the one or more processors 504 are in communication with or include memory 506, such as volatile and/or non-volatile memory that stores content, data or the like. For example, the memory 506 may store content transmitted from, and/or received by, the entity. Also for example, the memory 506 may store software applications, instructions or the like for the one or more processors 504 to perform steps associated with operation of the entity in accordance with embodiments of the present invention. In particular, the one or more processors 504 may be configured to perform the processes discussed in more detail herein for determining, using the location determination device 502, a location for the entity; transmitting a request to a separate entity (e.g., server 102), wherein the request is to access a second device that is within a defined distance of the entity. The request includes location information for the entity. In one aspect, the processor 504 can be configured to receive a public/private key pair for the entity that has been created by a separate device such as the server 102 and store the key pair in the memory 506. In another aspect, the processor 504 can be configured to generate a public/private key pair for the entity using a software agent that at least partially resides in the memory 506 and transmit at least the public key to a separate device such as the server 102. The processor 504 can also be configured to receive the public key of a second device and mutually authenticate itself with the second device by receiving an encrypted message from the second device that has been encrypted with the entity's public key and decrypting the message with the entity's private key while concurrently encrypting a message with the second device's public key and transmitting the encrypted message to the second device. In one aspect, the mutual authentication process can involve the use of a trusted intermediary such as the server 102.
  • In addition to the memory 506, the one or more processors 504 can also be connected to at least one interface or other means for displaying, transmitting and/or receiving data, content or the like. In this regard, the interface(s) can optionally include at least one communication interface 512 or other means for transmitting and/or receiving data, content or the like, as well as at least one user interface that can include a display 514 and/or a user input interface 516. In one aspect, the optional communication interface 512 can be used to transfer data or receive commands from and transfer information to a remote computing device 102 such as the one described herein over a network 108. In one aspect, the network 108 can be an advanced metering infrastructure (AMI) network, as described herein. In one aspect, the communication interface 512 can comprise a wireless communication interface such as a Wi-Fi transceiver. The user input interface 516, in turn, can comprise any of a number of devices allowing the entity to receive data from a user, such as a keypad, a touch display, a joystick or other input device.
  • FIGS. 6A and 6B illustrate alternative embodiments of the entity shown in FIG. 5 and illustrate embodiments of a schematic block diagram of entities capable of operating as one of a first device 104 or second device 106. In FIG. 6A, the illustrated entity includes all the elements as describe in FIG. 5A except a display. In FIG. 6B, the illustrated entity includes all the elements as describe in FIG. 5A except a display and a location determination device. In such an embodiment, the location of the entity can be stored in the memory 506 of the entity of an intermittent basis (such as when the entity is moved), or the location information can be stored in the memory of a separate device such as computing device (server) 102.
  • FIG. 7 is a flowchart illustrating a method of practicing an embodiment of the present invention. The described method comprises an embodiment of a method for mutual certificate authentication between a first device and a second device based on location. At step 702, a request is received from a first device. In one aspect, the request is accompanied by location information (e.g., coordinates) for the first device. In one aspect, the request is sent from a first device to a server. At step 704, in response to the request, a first public key is registered for the first device. In one aspect, registering a first public key for the first device in response to the request comprises generating a public/private key pair for the first device and distributing the key pair to the first device. In one aspect, the first public key is generated by and distributed from a server to the first device. In another aspect, registering a first public key for the first device in response to the request comprises receiving the first public key from the first device, wherein a software agent residing on the first device generates a public/private key pair for the first device. In one aspect, the first public key is received by a server from the first device. At step 706, at least one second device is determined that can be accessed by the first device based upon a location of the second device relative to the location of the first device. In one aspect, the second device is determined from a plurality of devices. In one aspect, the second device is determined based on it being at or within a defined distance or radius of the first device. In one aspect, determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device comprises a server processor retrieving stored locations of one or more second devices from a database stored in a memory associated with the server and comparing the location of the first device to the locations of the one or more second devices to determine whether the second device is at or within a defined distance from the first device. In another aspect, the second device is configured to determine its location and determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device comprises the server processor receiving location information from the second device and comparing the location of the first device to the location of the second device to determine whether the second device is at or within a defined distance from the first device. In one aspect, a server notifies the second device that the first device desires to access the second device.
  • At step 708, a second public key is registered for the second device, wherein the registration associates the second device with the second public key. In one aspect, a second software agent residing on the second device generates a second public key and a second private key in response to a notification that the first device desires to access the second device. In one aspect, the notification is received by the second device from a server. In another aspect, the notification is received by the second device from the first device. In one aspect, registering a second public key for the second device comprises generating a public/private key pair for the second device and distributing the key pair to the second device. In one aspect, a server generates a public/private key pair for the second device and distributing the key pair to the second device. In another aspect, registering a second public key for the second device comprises receiving the second public key from the second device, wherein a software agent residing on the second device generates a public/private key pair for the second device. In one aspect, the second public key from the second device is received by a server. At step 710, the first public key is sent to the second device and at step 712, the second public key is sent to the first device. At step 714, the first device and the second device are mutually authenticated to one another when they are connected using the first public key and the second public key. In on aspect, the first public key or the second public key are valid only while the first device is located at or within a defined distance of the second device. In one aspect, the first public key or the second public key are valid only for a defined time period.
  • The above system has been described above as comprised of units. One skilled in the art will appreciate that this is a functional description and that software, hardware, or a combination of software and hardware can perform the respective functions. A unit, such as the first device 104, second device 106, server 102 the network 108, etc., can be software, hardware, or a combination of software and hardware. The units can comprise the mutual authentication software 806 as illustrated in FIG. 8 and described below. Reference is now made to FIG. 8, which illustrates one type of electronic device that would benefit from embodiments of the present invention. As shown, the electronic device may be a server 102.
  • FIG. 8 is a block diagram illustrating an exemplary operating environment for performing the disclosed methods. This exemplary operating environment is only an example of an operating environment and is not intended to suggest any limitation as to the scope of use or functionality of operating environment architecture. Neither should the operating environment be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary operating environment.
  • The present methods and systems can be operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that can be suitable for use with the systems and methods comprise, but are not limited to, personal computers, server computers, laptop devices, and multiprocessor systems. Additional examples comprise machine monitoring systems, programmable consumer electronics, network PCs, minicomputers, mainframe computers, smart meters, smart-grid components, distributed computing environments that comprise any of the above systems or devices, and the like.
  • The processing of the disclosed methods and systems can be performed by software components. The disclosed systems and methods can be described in the general context of computer-executable instructions, such as program modules, being executed by one or more computers or other devices. Generally, program modules comprise computer code, routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The disclosed methods can also be practiced in grid-based and distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.
  • Further, one skilled in the art will appreciate that the systems and methods disclosed herein can be implemented via a computing device such as server 102. The components of the server 102 can comprise, but are not limited to, one or more processors or processing units 803, a system memory 812, and a system bus 813 that couples various system components including the processor 803 to the system memory 812. In the case of multiple processing units 803, the system can utilize parallel computing.
  • The system bus 813 represents one or more of several possible types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, such architectures can comprise an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, an Accelerated Graphics Port (AGP) bus, and a Peripheral Component Interconnects (PCI), a PCI-Express bus, a Personal Computer Memory Card Industry Association (PCMCIA), Universal Serial Bus (USB) and the like. The bus 813, and all buses specified in this description can also be implemented over a wired or wireless network connection and each of the subsystems, including the processor 803, a mass storage device 804, an operating system 805, mutual authentication software 806, key registration data 807, a network adapter 808, system memory 812, an input/output interface 810, a display adapter 809, a display device 811, and a human machine interface 802, can be contained within one or more remote computing devices or clients 814a,b,c at physically separate locations, connected through buses of this form, in effect implementing a fully distributed system or distributed architecture.
  • The server 102 typically comprises a variety of computer readable media. Exemplary readable media can be any available media that is non-transitory and accessible by the server 102 and comprises, for example and not meant to be limiting, both volatile and non-volatile media, removable and non-removable media. The system memory 812 comprises computer readable media in the form of volatile memory, such as random access memory (RAM), and/or non-volatile memory, such as read only memory (ROM). The system memory 812 typically contains data such as key registration data 807 and/or program modules such as operating system 805 and mutual authentication software 806 that are immediately accessible to and/or are presently operated on by the processing unit 803.
  • For example, the memory 812 may store content transmitted from, and/or received by, the server 102. Also for example, the memory 812 may store software applications, instructions or the like for the one or more processors 803 to perform steps associated with operation of the entity in accordance with embodiments of the present invention. In particular, the one or more processors 803 may be configured to perform the processes discussed in more detail herein for mutual certificate authentication between a first device and a second device based on location comprising receiving a request from a first device, wherein the request comprises a location of the first device; registering a first public key for the first device in response to the request, wherein the registration associates the first device with the first public key; determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device; registering a second public key for the second device, wherein the registration associates the second device with the second public key; sending the second public key to the first device; sending the first public key to the second device; and mutually authenticating the first device to the second device when the first device and the second device are connected.
  • In another aspect, the server 102 can also comprise other non-transitory, removable/non-removable, volatile/non-volatile computer storage media. By way of example, FIG. 8 illustrates a mass storage device 804 that can provide non-volatile storage of computer code, computer readable instructions, data structures, program modules, and other data for the server 102. For example and not meant to be limiting, a mass storage device 804 can be a hard disk, a removable magnetic disk, a removable optical disk, magnetic cassettes or other magnetic storage devices, flash memory cards, CD-ROM, digital versatile disks (DVD) or other optical storage, random access memories (RAM), read only memories (ROM), electrically erasable programmable read-only memory (EEPROM), and the like.
  • Optionally, any number of program modules can be stored on the mass storage device 804, including by way of example, an operating system 805 and mutual authentication software 806. Each of the operating system 905 and mutual authentication software 806 (or some combination thereof) can comprise elements of the programming and the mutual authentication software 806. Key registration data 807 can also be stored on the mass storage device 904. Key registration data 807 can be stored in any of one or more databases known in the art. Examples of such databases comprise, DB2® (IBM Corporation, Armonk, NY), Microsoft® Access, Microsoft® SQL Server, (Microsoft Corporation, Bellevue, Washington), Oracle®, (Oracle Corporation, Redwood Shores, California), mySQL, PostgreSQL, and the like. The databases can be centralized or distributed across multiple systems.
  • In another aspect, the user can enter commands and information into the server 102 via an input device (not shown). Examples of such input devices comprise, but are not limited to, a keyboard, pointing device (e.g., a "mouse"), a microphone, a joystick, a scanner, tactile input devices such as gloves, and other body coverings, and the like These and other input devices can be connected to the processing unit 803 via a human machine interface 802 that is coupled to the system bus 813, but can be connected by other interface and bus structures, such as a parallel port, game port, an IEEE 1394 Port (also known as a Firewire port), a serial port, or a universal serial bus (USB).
  • In yet another aspect, a display device 811 can also be connected to the system bus 813 via an interface, such as a display adapter 809. It is contemplated that the server 102 can have more than one display adapter 809 and the server 102 can have more than one display device 811. For example, a display device can be a monitor, an LCD (Liquid Crystal Display), or a projector. In addition to the display device 811, other output peripheral devices can comprise components such as speakers (not shown) and a printer (not shown), which can be connected to the server 102 via Input/Output Interface 810. Any step and/or result of the methods can be output in any form to an output device. Such output can be any form of visual representation, including, but not limited to, textual, graphical, animation, audio, tactile, and the like.
  • The server 102 can operate in a networked environment using logical connections to one or more remote computing devices or clients 814a,b,c. By way of example, a remote computing device 814 can be a personal computer, portable computer, a server, a router, a network computer, a vendor or manufacture's computing device, a master station, an electric vehicle charging station (EVCS), peer device or other common network node, and so on. In one aspect, remote computing device 814 can be first device 104 or second device 106 as described herein. Logical connections between the server 102 and a remote computing device or client 814a,b,c can be made via a local area network (LAN) and a general wide area network (WAN). Such network connections can be through a network adapter 808. A network adapter 808 can be implemented in both wired and wireless environments. Such networking environments are conventional and commonplace in offices, enterprise-wide computer networks, intranets, and other networks 815 such as the Internet or an AMI network.
  • For purposes of illustration, application programs and other executable program components such as the operating system 805 are illustrated herein as discrete blocks, although it is recognized that such programs and components reside at various times in different storage components of the server 102, and are executed by the data processor(s) of the server 102. An implementation of mutual authentication software 806 can be stored on or transmitted across some form of computer readable media. Any of the disclosed methods can be performed by computer readable instructions embodied on computer readable media. Computer readable media can be any available media that can be accessed by a computer. By way of example and not meant to be limiting, computer readable media can comprise "computer storage media" and "communications media." "Computer storage media" comprise volatile and non-volatile, removable and non-removable media implemented in any methods or technology for storage of information such as computer readable instructions, data structures, program modules, or other data. Exemplary computer storage media comprises, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer.
  • The methods and systems can employ Artificial Intelligence techniques such as machine learning and iterative learning. Examples of such techniques include, but are not limited to, expert systems, case based reasoning, Bayesian networks, behavior based AI, neural networks, fuzzy systems, evolutionary computation (e.g. genetic algorithms), swarm intelligence (e.g. ant algorithms), and hybrid intelligent systems (e.g. Expert inference rules generated through a neural network or production rules from statistical learning).
  • As described above and as will be appreciated by one skilled in the art, embodiments of the present invention may be configured as a system, method, or computer program product. Accordingly, embodiments of the present invention may be comprised of various means including entirely of hardware, entirely of software, or any combination of software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product on a computer-readable storage medium having computer-readable program instructions (e.g., computer software) embodied in the storage medium. Any suitable non-transitory computer-readable storage medium may be utilized including hard disks, CD-ROMs, optical storage devices, or magnetic storage devices.
  • Embodiments of the present invention have been described above with reference to block diagrams and flowchart illustrations of methods, apparatuses (i.e., systems) and computer program products. It will be understood that each block of the block diagrams and flowchart illustrations, and combinations of blocks in the block diagrams and flowchart illustrations, respectively, can be implemented by various means including computer program instructions. These computer program instructions may be loaded onto a general purpose computer, special purpose computer, or other programmable data processing apparatus, such as the one or more processors 504 discussed above with reference to FIGS. 5, 6A or 6B, or the one or more processors 803 discussed above with reference to FIG. 8, to produce a special-purpose machine, such that the instructions which execute on the computer or other programmable data processing apparatus create a means for implementing the functions specified in the flowchart block or blocks.
  • These computer program instructions may also be stored in a non-transitory computer-readable memory that can direct a computer or other programmable data processing apparatus (e.g., such as the one or more processors 504 discussed above with reference to FIGS. 5, 6A or 6B, or the one or more processors 803 discussed above with reference to FIG. 8) to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including computer-readable instructions for implementing the function specified in the flowchart block or blocks. The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.
  • Accordingly, blocks of the block diagrams and flowchart illustrations support combinations of means for performing the specified functions, combinations of steps for performing the specified functions and program instruction means for performing the specified functions. It will also be understood that each block of the block diagrams and flowchart illustrations, and combinations of blocks in the block diagrams and flowchart illustrations, can be implemented by special purpose hardware-based computer systems that perform the specified functions or steps, or combinations of special purpose hardware and computer instructions.
  • Unless otherwise expressly stated, it is in no way intended that any method set forth herein be construed as requiring that its steps be performed in a specific order. Accordingly, where a method claim does not actually recite an order to be followed by its steps or it is not otherwise specifically stated in the claims or descriptions that the steps are to be limited to a specific order, it is no way intended that an order be inferred, in any respect. This holds for any possible non-express basis for interpretation, including: matters of logic with respect to arrangement of steps or operational flow; plain meaning derived from grammatical organization or punctuation; the number or type of embodiments described in the specification.
  • Throughout this application, various publications may be referenced. The disclosures of these publications in their entireties are hereby incorporated by reference into this application in order to more fully describe the state of the art to which the methods and systems pertain.
  • Many modifications and other embodiments of the inventions set forth herein will come to mind to one skilled in the art to which these embodiments of the invention pertain having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the embodiments of the invention are not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Moreover, although the foregoing descriptions and the associated drawings describe exemplary embodiments in the context of certain exemplary combinations of elements and/or functions, it should be appreciated that different combinations of elements and/or functions may be provided by alternative embodiments without departing from the scope of the appended claims. In this regard, for example, different combinations of elements and/or functions than those explicitly described above are also contemplated as may be set forth in some of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.
  • Various aspects and embodiments of the invention are indicated in the following clauses:
  1. 1. A method for mutual certificate authentication between a first device and a second device based on location comprising:
    • receiving a request from a first device, wherein the request comprises a location of the first device;
    • registering a first public key for the first device in response to the request, wherein the registration associates the first device with the first public key;
    • determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device;
    • registering a second public key for the second device, wherein the registration associates the second device with the second public key;
    • sending the second public key to the first device;
    • sending the first public key to the second device; and
    • mutually authenticating the first device to the second device when the first device and the second device are connected.
  2. 2. The method of Clause 1, wherein the first device is a mobile device and the second device is a utility device.
  3. 3. The method of Clause 2, wherein the utility device is a utility meter.
  4. 4. The method of Clause 2, wherein the utility device includes one or more of a phasor measurement unit, a phasor data concentrator, and a power quality product.
  5. 5. The method of Clause 2, wherein the mobile device includes one or more of a laptop computer with GPS capability, a mobile phone with GPS capability, and a tablet computing device.
  6. 6. The method of Clause 1, wherein registering a first public key for the first device in response to the request comprises generating a public/private key pair for the first device and distributing the key pair to the first device.
  7. 7. The method of Clause 1, wherein registering a first public key for the first device in response to the request comprises receiving the first public key from the first device, wherein a software agent residing on the first device generates a public/private key pair for the first device.
  8. 8. The method of Clause 1, wherein registering a second public key for the second device comprises generating a public/private key pair for the second device and distributing the key pair to the second device.
  9. 9. The method of Clause 1, wherein registering a second public key for the second device comprises receiving the second public key from the second device, wherein a software agent residing on the second device generates a public/private key pair for the second device.
  10. 10. The method of Clause 1, wherein the first public key or the second public key are valid only while the first device is located at or within a defined distance of the second device.
  11. 11. The method of Clause 1, wherein the first public key or the second public key are valid only for a defined time period.
  12. 12. A method comprising
    sending a request from a first device to a server, wherein the request comprises location information for the first device;
    generating, by a first software agent residing on the first device, a first public key and a first private key;
    registering, by the server, the first public key for the first device, wherein the registration associates the first device with the first public key;
    issuing, by the server, a first certificate to the first device;
    determining, by the server, at least one second device that is accessible by the first device based on the location of the second device relative to the first device;
    notifying, by the server, the second device that the first device requests access to the second device;
    generating, by a second software agent residing on the second device, a second public key and a second private key in response to the notification;
    registering, by the server, the second public key for the second device, wherein the registration associates the second device with the second public key;
    issuing, by the server, a second certificate to the second device;
    sending, by the server, the second public key to the first device;
    sending, by the server, the first public key to the second device; and
    mutually authenticating, by the server, the first certificate and the second certificate when the first device and the second device are connected.
  13. 13. The method of Clause 12, wherein the first device is a mobile device and the second device is a utility device.
  14. 14. The method of Clause 13, wherein the utility device is a utility meter.
  15. 15. The method of Clause 13, wherein the utility device includes one or more of a phasor measurement unit, a phasor data concentrator, and a power quality product.
  16. 16. The method of Clause 13, wherein the mobile device includes one or more of a laptop computer with GPS capability, a mobile phone with GPS capability, and a tablet computing device.
  17. 17. The method of Clause 12, wherein registering, by the server, the first public key for the first device comprises the server receiving the first public key from the first device.
  18. 18. The method of Clause 12, wherein registering, by the server, the second public key for the second device comprises the server receiving the second public key from the second device.
  19. 19. The method of Clause 12, wherein the first public key or the second public key are valid only while the first device is located at or within a defined distance of the second device.
  20. 20. The method of Clause 12, wherein the first public key or the second public key are valid only for a defined time period.
  21. 21. A system for mutual certificate authentication between a first device and a second device based on location, the system comprised of:
    • a first device, wherein the first device is comprised of at least a first software agent executing on a first processor and a first communications interface, and the first device is configured to determine its location;
    • a second device, wherein the second device is comprised of at least a second software agent executing on a second processor and a second communications interface;
    • a server comprised of at least a memory, a server communications interface and a server processor, wherein the server is configured to communicate with the first device and the second device and wherein the server processor is configured to:
      • receive a request from a first device, wherein the request comprises a location of the first device;
      • register a first public key for the first device in response to the request, wherein the registration associates the first device with the first public key;
      • determine at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device;
      • register a second public key for the second device, wherein the registration associates the second device with the second public key;
      • send the second public key to the first device;
      • send the first public key to the second device; and
      • mutually authenticate the first device to the second device when the first device and the second device are connected.
  22. 22. The system of Clause 21, wherein the first device is a mobile device and the second device is a utility device.
  23. 23. The system of Clause 22, wherein the utility device is a utility meter.
  24. 24. The system of Clause 22, wherein the utility device includes one or more of a phasor measurement unit, a phasor data concentrator, and a power quality product.
  25. 25. The system of Clause 22, wherein the mobile device includes one or more of a laptop computer with GPS capability, a mobile phone with GPS capability, and a tablet computing device.
  26. 26. The system of Clause 21, wherein the first device includes a GPS receiver and the first device determines its location using the GPS receiver.
  27. 27. The system of Clause 21, wherein registering a first public key for the first device in response to the request comprises the server processor generating a public/private key pair for the first device and distributing the key pair to the first device.
  28. 28. The system of Clause 21, wherein registering a first public key for the first device in response to the request comprises the server receiving the first public key from the first device, wherein the first software agent residing on the first device generates a public/private key pair for the first device.
  29. 29. The system of Clause 21, wherein registering a second public key for the second device comprises the server processor generating a public/private key pair for the second device and distributing the key pair to the second device.
  30. 30. The system of Clause 21, wherein registering a second public key for the second device comprises the server receiving the second public key from the second device, wherein second software agent residing on the second device generates a public/private key pair for the second device.
  31. 31. The system of Clause 21, wherein the first public key or the second public key are valid only while the first device is located at or within a defined distance of the second device.
  32. 32. The system of Clause 21, wherein the first public key or the second public key are valid only for a defined time period.
  33. 33. The system of Clause 21, wherein determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device comprises the server processor retrieving stored locations of one or more second devices from a database stored in the memory and comparing the location of the first device to the locations of the one or more second devices to determine whether the second device is at or within a defined distance from the first device.
  34. 34. The system of Clause 21, wherein the second device is configured to determine its location and determining at least one second device that can be accessed by the first device based upon a location of the second device relative to the location of the first device comprises the server processor receiving location information from the second device and comparing the location of the first device to the location of the second device to determine whether the second device is at or within a defined distance from the first device.

Claims (10)

  1. A method for mutual certificate authentication between a first device (104) and a second device (106) based on location comprising:
    receiving a request from a first device (104), wherein the request comprises a location of the first device (104);
    registering a first public key for the first device (104) in response to the request, wherein the registration associates the first device (104) with the first public key;
    determining at least one second device (106) that can be accessed by the first device (104) based upon a location of the second device (106) relative to the location of the first device (104);
    registering a second public key for the second device (106), wherein the registration associates the second device (106) with the second public key;
    sending the second public key to the first device (104);
    sending the first public key to the second device (106); and
    mutually authenticating the first device (104) to the second device (106) when the first device (104) and the second device (106) are connected.
  2. The method of Claim 1, wherein registering a first public key for the first device (104) in response to the request comprises generating a public/private key pair for the first device (104) and distributing the key pair to the first device (104).
  3. The method of either of Claim 1 or 2, wherein registering a first public key for the first device (104) in response to the request comprises receiving the first public key from the first device (104), wherein a software agent (110) residing on the first device (104) generates a public/private key pair for the first device (104).
  4. The method of any preceding Claim, wherein registering a second public key for the second device (106) comprises generating a public/private key pair for the second device (106) and distributing the key pair to the second device (106).
  5. The method of any preceding Claim, wherein registering a second public key for the second device (106) comprises receiving the second public key from the second device (106), wherein a software agent (112) residing on the second device (106) generates a public/private key pair for the second device (106).
  6. A system for mutual certificate authentication between a first device (104) and a second device (106) based on location, the system comprised of
    a first device (104), wherein the first device (104) is comprised of at least a first software agent (302) executing on a first processor (504) and a first communications interface (304), and the first device (104) is configured to determine its location;
    a second device (106), wherein the second device is comprised of at least a second software agent (308) executing on a second processor (504) and a second communications interface (310);
    a server (102) comprised of at least a memory (312), a server communications interface (810) and a server processor (803), wherein the server (102) is configured to communicate with the first device (104) and the second device (106) and wherein the server processor (803) is configured to:
    receive a request from a first device (104), wherein the request comprises a location of the first device (104);
    register a first public key for the first device (104) in response to the request, wherein the registration associates the first device (104) with the first public key;
    determine at least one second device (106) that can be accessed by the first device (104) based upon a location of the second device (106) relative to the location of the first device (104);
    register a second public key for the second device (106), wherein the registration associates the second device (106) with the second public key;
    send the second public key to the first device (104);
    send the first public key to the second device (106); and
    mutually authenticate the first device (104) to the second device (106) when the first device (104) and the second device (106) are connected.
  7. The system of Claim 6, wherein the first device (04) is a mobile device and the second device (106) is a utility device, wherein the utility device includes one or more of a utility meter, a phasor measurement unit, a phasor data concentrator, and a power quality product, and wherein the mobile device includes one or more of a laptop computer with GPS capability, a mobile phone with GPS capability, and a tablet computing device.
  8. The system of either of Claim 6 or 7, wherein the first device (104) includes a GPS receiver (306) and the first device (104) is operable to determine its location using the GPS receiver (306).
  9. The system of any of Claims 6 to 8, operable such that determining at least one second device (106) that can be accessed by the first device (104) based upon a location of the second device (106) relative to the location of the first device (104) comprises the server processor (803) retrieving stored locations of one or more second devices (106) from a database stored in the memory (812) and comparing the location of the first device (104) to the locations of the one or more second devices (106) to determine whether the second device (106) is at or within a defined distance from the first device (104).
  10. The system of any of Claims 6 to 9, wherein the second device (106) is configured to determine its location and determining at least one second device (106) that can be accessed by the first device (104) based upon a location of the second device (106) relative to the location of the first device (104) comprises the server processor (803) receiving location information from the second device (106) and comparing the location of the first device (104) to the location of the second device (106) to determine whether the second device (106) is at or within a defined distance from the first device (104).
EP12172793.7A 2011-06-27 2012-06-20 Method and system of location-aware certificate based authentication Active EP2541457B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US13/169,471 US10068084B2 (en) 2011-06-27 2011-06-27 Method and system of location-aware certificate based authentication

Publications (3)

Publication Number Publication Date
EP2541457A2 true EP2541457A2 (en) 2013-01-02
EP2541457A3 EP2541457A3 (en) 2013-09-11
EP2541457B1 EP2541457B1 (en) 2020-10-07

Family

ID=46603543

Family Applications (1)

Application Number Title Priority Date Filing Date
EP12172793.7A Active EP2541457B1 (en) 2011-06-27 2012-06-20 Method and system of location-aware certificate based authentication

Country Status (3)

Country Link
US (1) US10068084B2 (en)
EP (1) EP2541457B1 (en)
CN (1) CN102857492B (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2505322A (en) * 2012-08-21 2014-02-26 Strategy & Technology Ltd Host Device Authentication Using Mutual Authentication
WO2020112392A1 (en) * 2018-11-27 2020-06-04 Microsoft Technology Licensing, Llc Trusted execution based on environmental factors

Families Citing this family (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009035728A1 (en) * 2007-09-14 2009-03-19 Cabouli Steven D Smart wallet
FR2983374B1 (en) * 2011-11-29 2015-04-10 Oberthur Technologies PROTOCOL OF MUTUAL AUTHENTICATION
US9131333B2 (en) 2011-12-30 2015-09-08 Linkedin Corporation Systems and methods for mobile device pairing
US9098133B2 (en) 2011-12-30 2015-08-04 Linkedin Corporation Mobile device pairing
US9137627B2 (en) 2011-12-30 2015-09-15 Linkedin Corporation Systems and methods for mobile device pairing
JP5701792B2 (en) * 2012-02-27 2015-04-15 株式会社東芝 COMMUNICATION DEVICE, COMMUNICATION METHOD, AND COMMUNICATION PROGRAM
JP6175820B2 (en) * 2012-06-27 2017-08-09 株式会社リコー Communication apparatus and communication system
US8831224B2 (en) * 2012-09-14 2014-09-09 GM Global Technology Operations LLC Method and apparatus for secure pairing of mobile devices with vehicles using telematics system
US9247432B2 (en) * 2012-10-19 2016-01-26 Airwatch Llc Systems and methods for controlling network access
US9201579B2 (en) 2012-12-07 2015-12-01 Linkedin Corporation Slide to apply
US10038679B2 (en) * 2012-12-24 2018-07-31 Intel Corporation Centralized secure device pairing
US9621659B1 (en) * 2013-07-09 2017-04-11 Faryar Ghazanfari Systems and methods for peer to peer communication
KR102044493B1 (en) * 2013-07-30 2019-11-13 삼성전자주식회사 Method and its apparatus for configuring the position of target device
TWI487413B (en) * 2013-09-05 2015-06-01 Chunghwa Telecom Co Ltd Wireless Location Method and System with Load Balancing and Phenomenon Replacement
US8943569B1 (en) 2013-10-01 2015-01-27 Myth Innovations, Inc. Wireless server access control system and method
US9830446B2 (en) * 2013-10-16 2017-11-28 Silver Spring Networks, Inc. Return material authorization fulfillment system for smart grid devices with customer specific cryptographic credentials
US9824514B2 (en) * 2014-02-11 2017-11-21 Tyco Fire & Security Gmbh Applying geographical limitations to control actions of a security system
US9344419B2 (en) 2014-02-27 2016-05-17 K.Y. Trix Ltd. Methods of authenticating users to a site
US9577823B2 (en) 2014-03-21 2017-02-21 Venafi, Inc. Rule-based validity of cryptographic key material
US9686244B2 (en) 2014-03-21 2017-06-20 Venafi, Inc. Rule-based validity of cryptographic key material
US9654922B2 (en) * 2014-03-21 2017-05-16 Venafi, Inc. Geo-fencing cryptographic key material
US9647998B2 (en) 2014-03-21 2017-05-09 Venafi, Inc. Geo-fencing cryptographic key material
US9531533B2 (en) 2014-03-21 2016-12-27 Venafi, Inc. Rule-based validity of cryptographic key material
US9680827B2 (en) * 2014-03-21 2017-06-13 Venafi, Inc. Geo-fencing cryptographic key material
CN103888461B (en) * 2014-03-26 2017-04-26 卡斯柯信号有限公司 Method for achieving dynamic registration based on Subset-037 protocol
US9413738B2 (en) * 2014-06-19 2016-08-09 Microsoft Technology Licensing, Llc Securing communications with enhanced media platforms
US9635547B1 (en) * 2014-07-28 2017-04-25 Amazon Technologies, Inc. Systems, devices, and methods for obfuscating location
US20160062722A1 (en) * 2014-09-03 2016-03-03 ProSports Technologies, LLC Multiple display controller system
US9130744B1 (en) * 2014-09-22 2015-09-08 Envelope, Llc Sending an encrypted key pair and a secret shared by two devices to a trusted intermediary
US9821768B2 (en) * 2014-10-01 2017-11-21 Continental Intelligent Transportation Systems LLC Geo-proximity vehicle alert and access system for security and package exchange efficiency
US20160232533A1 (en) * 2014-12-30 2016-08-11 Lawrence F. Glaser Automation of Personal Finance, Credit Offerings and Credit Risk Data Reporting
CN105120455B (en) * 2015-07-22 2019-02-01 北京元心科技有限公司 A kind of method and system of voice communication encrypting and decrypting
JP6727292B2 (en) * 2015-08-24 2020-07-22 華為技術有限公司Huawei Technologies Co.,Ltd. Security authentication methods, configuration methods, and related devices
US10826875B1 (en) * 2016-07-22 2020-11-03 Servicenow, Inc. System and method for securely communicating requests
US10667134B2 (en) * 2016-11-21 2020-05-26 International Business Machines Corporation Touch-share credential management on multiple devices
JP6465098B2 (en) * 2016-11-24 2019-02-06 トヨタ自動車株式会社 Vehicle authentication system
US10412581B2 (en) * 2017-02-14 2019-09-10 Ford Global Technologies, Llc Secure session communication between a mobile device and a base station
US10848481B1 (en) * 2019-05-17 2020-11-24 The Florida International University Board Of Trustees Systems and methods for revocation management in an AMI network

Family Cites Families (70)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5659617A (en) * 1994-09-22 1997-08-19 Fischer; Addison M. Method for providing location certificates
US6088450A (en) * 1996-04-17 2000-07-11 Intel Corporation Authentication system based on periodic challenge/response protocol
JP2000244655A (en) 1999-02-18 2000-09-08 Fujitsu Ltd Network system having secrecy service function
US7197556B1 (en) 1999-10-22 2007-03-27 Nomadix, Inc. Location-based identification for use in a communications network
US6819919B1 (en) * 1999-10-29 2004-11-16 Telcontar Method for providing matching and introduction services to proximate mobile users and service providers
JP2002016592A (en) 2000-04-25 2002-01-18 Open Loop:Kk Encryption key management system and encryption key management method
FI110558B (en) * 2000-05-24 2003-02-14 Nokia Corp A method for processing location information of a terminal connected to a packet data network over a mobile communication network
US6542750B2 (en) * 2000-06-10 2003-04-01 Telcontar Method and system for selectively connecting mobile users based on physical proximity
JP2004515840A (en) * 2000-08-04 2004-05-27 ファースト データ コーポレイション Method and apparatus for an access authentication entity
JP3669293B2 (en) * 2000-08-04 2005-07-06 ソニー株式会社 Wireless device mutual authentication system, wireless device mutual authentication method, and wireless device
US9107030B2 (en) * 2000-12-13 2015-08-11 Thomas E. Coverstone Communication system for sending advertisements based on location determination and previously specified user selections
US6446004B1 (en) * 2001-02-28 2002-09-03 International Business Machines Corporation System and method for implementing proximity or location driven activities
US7516325B2 (en) * 2001-04-06 2009-04-07 Certicom Corp. Device authentication in a PKI
JP2003101523A (en) 2001-09-21 2003-04-04 Fujitsu Ltd Communication network system and communication method having concealment function
WO2003049326A1 (en) * 2001-12-06 2003-06-12 Fujitsu Limited Portable terminal having function of detecting approach of person by using proximity wireless communication means, recorded medium used for the same, and server
DE60334446D1 (en) * 2002-03-01 2010-11-18 Enterasys Networks Inc ORDINARY DATA NETWORK
WO2003105400A1 (en) * 2002-06-07 2003-12-18 ソニー株式会社 Data processing system, data processing device, data processing method, and computer program
US7212806B2 (en) * 2002-09-12 2007-05-01 Broadcom Corporation Location-based transaction authentication of wireless terminal
US7545941B2 (en) * 2003-09-16 2009-06-09 Nokia Corporation Method of initializing and using a security association for middleware based on physical proximity
US6978023B2 (en) * 2003-03-25 2005-12-20 Sony Corporation Apparatus and method for location based wireless client authentication
US20050026596A1 (en) 2003-07-28 2005-02-03 Oren Markovitz Location-based AAA system and method in a wireless network
US20050038876A1 (en) * 2003-08-15 2005-02-17 Aloke Chaudhuri System and method for instant match based on location, presence, personalization and communication
US7450930B2 (en) 2003-12-05 2008-11-11 Motion Picture Association Of America Digital rights management using a triangulating geographic locating device
CN1950780A (en) * 2004-03-10 2007-04-18 松下电器产业株式会社 Authentication system and authentication apparatus
US7378939B2 (en) * 2004-03-30 2008-05-27 Sengupta Uttam K Method and apparatus for providing proximity based authentication, security, and notification in a wireless system
US20050229004A1 (en) * 2004-03-31 2005-10-13 Callaghan David M Digital rights management system and method
JP4732775B2 (en) 2004-03-31 2011-07-27 パナソニック株式会社 Rights management terminal, server device, and usage information collection system
US7649997B2 (en) * 2004-06-30 2010-01-19 Gm Global Technology Operations, Inc. User transparent registration process for secure communication
JP4555175B2 (en) * 2004-07-20 2010-09-29 株式会社リコー Examination device, communication system, examination method, program, and recording medium
US7283062B2 (en) * 2004-07-28 2007-10-16 Itron, Inc. Mapping in mobile data collection systems, such as for utility meter reading and related applications
CN101023651A (en) * 2004-09-17 2007-08-22 皇家飞利浦电子股份有限公司 Proximity check server
US8166296B2 (en) * 2004-10-20 2012-04-24 Broadcom Corporation User authentication system
WO2006047694A1 (en) * 2004-10-25 2006-05-04 Orsini Rick L Secure data parser method and system
US7308251B2 (en) 2004-11-19 2007-12-11 Broadcom Corporation Location-based authentication of wireless terminal
CN100389555C (en) * 2005-02-21 2008-05-21 西安西电捷通无线网络通信有限公司 An access authentication method suitable for wired and wireless network
US7221949B2 (en) 2005-02-28 2007-05-22 Research In Motion Limited Method and system for enhanced security using location-based wireless authentication
EP1708527A1 (en) * 2005-03-31 2006-10-04 BRITISH TELECOMMUNICATIONS public limited company Location based authentication
EP1708528A1 (en) * 2005-03-31 2006-10-04 BRITISH TELECOMMUNICATIONS public limited company Location based authentication
US8150416B2 (en) * 2005-08-08 2012-04-03 Jambo Networks, Inc. System and method for providing communication services to mobile device users incorporating proximity determination
US20070037574A1 (en) * 2005-08-09 2007-02-15 Jonathan Libov Method and apparatus of a location-based network service for mutual social notification
US20070050314A1 (en) * 2005-08-31 2007-03-01 Martin Murray D System and method for managing postage funds for use by multiple postage meters
US9177114B2 (en) * 2005-10-04 2015-11-03 Google Technology Holdings LLC Method and apparatus for determining the proximity of a client device
US8515348B2 (en) * 2005-10-28 2013-08-20 Electro Industries/Gauge Tech Bluetooth-enable intelligent electronic device
US8191161B2 (en) * 2005-12-13 2012-05-29 Microsoft Corporation Wireless authentication
WO2007081893A2 (en) * 2006-01-05 2007-07-19 Fuze Networks System and method for virtual personal network
US20070174243A1 (en) * 2006-01-20 2007-07-26 Fritz Charles W Mobile social search using physical identifiers
US20080077336A1 (en) * 2006-09-25 2008-03-27 Roosevelt Fernandes Power line universal monitor
US20080137859A1 (en) * 2006-12-06 2008-06-12 Ramanathan Jagadeesan Public key passing
US8332928B2 (en) * 2007-02-22 2012-12-11 Hewlett-Packard Development Company, L.P. Location attestation service
US9083745B2 (en) * 2007-03-12 2015-07-14 Qualcomm Incorporated Network independent location services
CN101267303B (en) 2007-03-13 2012-07-04 中兴通讯股份有限公司 Communication method between service nodes
GB2449510A (en) * 2007-05-24 2008-11-26 Asim Bucuk A method and system for the creation, management and authentication of links between people, entities, objects and devices
JP5141099B2 (en) 2007-06-12 2013-02-13 株式会社日立製作所 Automatic access key distribution system
US20090112767A1 (en) * 2007-10-25 2009-04-30 Ayman Hammad Escrow system and method
US8104091B2 (en) * 2008-03-07 2012-01-24 Samsung Electronics Co., Ltd. System and method for wireless communication network having proximity control based on authorization token
US20100278345A1 (en) * 2009-05-04 2010-11-04 Thomas Matthieu Alsina Method and apparatus for proximity based pairing of mobile devices
US8045961B2 (en) * 2009-06-22 2011-10-25 Mourad Ben Ayed Systems for wireless authentication based on bluetooth proximity
US8745250B2 (en) * 2009-06-30 2014-06-03 Intel Corporation Multimodal proximity detection
US8509954B2 (en) * 2009-08-21 2013-08-13 Allure Energy, Inc. Energy management system and method
US8458776B2 (en) * 2009-10-21 2013-06-04 Microsoft Corporation Low-latency peer session establishment
US8305232B2 (en) * 2009-11-19 2012-11-06 Silver Spring Networks, Inc. Utility network interface device configured to detect and report abnormal operating condition
CN106230872A (en) * 2009-11-25 2016-12-14 安全第公司 To moving medial according to the system and method protected
US20110137803A1 (en) * 2009-12-03 2011-06-09 Symbol Technologies, Inc. Secure electronic receipt systems and methods
US8898468B2 (en) * 2009-12-08 2014-11-25 Bae Systems Information And Electronic Systems Integration Inc. Method for ensuring security and privacy in a wireless cognitive network
JP5663083B2 (en) * 2010-03-31 2015-02-04 セキュリティー ファースト コープ. System and method for securing data in motion
AU2011289318B2 (en) * 2010-08-11 2016-02-25 Security First Corp. Systems and methods for secure multi-tenant data storage
US9030334B2 (en) * 2010-09-10 2015-05-12 Southern Company Services, Inc. Locating utility metering devices
US9258627B2 (en) * 2010-09-10 2016-02-09 Southern Company Services, Inc. Locating utility metering devices
AU2012261972A1 (en) * 2011-06-01 2014-01-09 Security First Corp. Systems and methods for secure distributed storage
US9838525B2 (en) * 2014-01-03 2017-12-05 General Electric Company Systems and methods for coupling auxiliary devices to a utility meter

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2505322A (en) * 2012-08-21 2014-02-26 Strategy & Technology Ltd Host Device Authentication Using Mutual Authentication
GB2505322B (en) * 2012-08-21 2014-12-17 Strategy & Technology Ltd Device authentication
WO2020112392A1 (en) * 2018-11-27 2020-06-04 Microsoft Technology Licensing, Llc Trusted execution based on environmental factors

Also Published As

Publication number Publication date
EP2541457B1 (en) 2020-10-07
US20120328101A1 (en) 2012-12-27
EP2541457A3 (en) 2013-09-11
US10068084B2 (en) 2018-09-04
CN102857492A (en) 2013-01-02
CN102857492B (en) 2018-06-12

Similar Documents

Publication Publication Date Title
Xie et al. A survey of blockchain technology applied to smart cities: Research issues and challenges
Basudan et al. A privacy-preserving vehicular crowdsensing-based road surface condition monitoring system using fog computing
Yang et al. Security and privacy in mobile crowdsourcing networks: challenges and opportunities
Knirsch et al. Privacy-preserving blockchain-based electric vehicle charging with dynamic tariff decisions
US10284654B2 (en) Trusted vehicle telematics using blockchain data analytics
CN107074200B (en) end-to-end system for service delivery to and from a vehicle using a dongle
Gao et al. GridMonitoring: Secured sovereign blockchain based monitoring on smart grid
Yigit et al. Cloud computing for smart grid applications
US9525556B2 (en) Method and system for issuing CSR certificate for vehicle-to-anything communication
Kang et al. Enabling localized peer-to-peer electricity trading among plug-in hybrid electric vehicles using consortium blockchains
Sun et al. User-defined privacy location-sharing system in mobile online social networks
Zhu et al. ASAP: An anonymous smart-parking and payment scheme in vehicular networks
Jiang et al. Achieving high performance and privacy-preserving query over encrypted multidimensional big metering data
CN106464698B (en) Wireless mesh network is protected via trust chain
US10693632B1 (en) Autonomous devices
CN105263051B (en) Portable authentication equipment
Kapadia et al. AnonySense: Opportunistic and privacy-preserving context collection
US20180272886A1 (en) Supply Medium Exchange System for Mobile Units
CN103503366B (en) Manage the data for authenticating device
US20180054727A1 (en) System and method for location privacy and location information management over wireless systems
US10439820B2 (en) Method and apparatus for secure access to a mobile edge computing gateway device based on a subscriber location fingerprint
Salinas et al. Privacy-preserving energy theft detection in smart grids: A P2P computing approach
US9621540B2 (en) Secure provisioning of computing devices for enterprise connectivity
US9137662B2 (en) Method and apparatus for access credential provisioning
US10243945B1 (en) Managed identity federation

Legal Events

Date Code Title Description
AX Request for extension of the european patent

Extension state: BA ME

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

17P Request for examination filed

Effective date: 20140311

17Q First examination report despatched

Effective date: 20180104

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 21/20 20181130AFI20121024BHEP

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 21/20 20060101AFI20121024BHEP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602012072638

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: G06F0021200000

Ipc: H04L0029060000

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 21/44 20130101ALI20200316BHEP

Ipc: H04L 29/06 20060101AFI20200316BHEP

INTG Intention to grant announced

Effective date: 20200430

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

Ref country code: AT

Ref legal event code: REF

Ref document number: 1322379

Country of ref document: AT

Kind code of ref document: T

Effective date: 20201015

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602012072638

Country of ref document: DE

REG Reference to a national code

Ref country code: SE

Ref legal event code: TRGR